'unsafe-eval'

[Emmker]

Is it safe to remove 'unsafe-eval' from CSP?

[Davide Alghi]

Hi Emmker,

as far as I know, removing unsafe-eval (and unsafe-inline) is safer, but it may break JS functions like eval() and JS constructors like Function().

In other words, the unsafe-eval directive allows the 'creation' of methods from strings, so it potentially opens the door to code injection attacks, but removing it may break some JS functions (if in the code)

In the past I was forced to insert the unsafe-eval and unsafe-inline directives in the Apache VirtualHost because otherwise the web-app did not work correctly.

[Emmker]

Hi Emmker,

as far as I know, removing unsafe-eval (and unsafe-inline) is safer, but it may break JS functions like eval() and JS constructors like Function().

In other words, the unsafe-eval directive allows the 'creation' of methods from strings, so it potentially opens the door to code injection attacks, but removing it may break some JS functions (if in the code)

So, removing the 'unsafe-eval' is not an option here as I understand.

yuri
I do not want to disable CSP all together.
I just have a request from my client to remove 'unsafe-eval' and add base-uri/object-src.
Is that possible or will it break espo functions?

[yuri]

I encourage to figure out by locking into code. It's been really hard for me to address multiple questions and resolving many issues on daily basis. The product would have been better if I haven't spent a big part of a day answering questions. Open source implies that everyone can look into code and figure out.

[Emmker]

I fully appreciate your work Yuri.
Didn't mean to bother you with my questions.
Not being a coder myself, is really difficult to review and understand everything here, but I will do my best.

Again. Thank you for your time and effort.

[yuri]

Sorry, I misunderstood a bit. If you remove, the application won't work. Often large web apps rely on apis that the unsafe-eval enables. We use it to for dynamic loading of modules and libs. Considering Espo is extensible in runtime, not sure if we can get rid of the unsafe-eval parameter soon.